<IfModule mod_ssl.c>
  <VirtualHost *:443>
    ServerAdmin root@localhost.internal
    ServerName jenkins.DOMAIN

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
    ErrorDocument 503 "Sleeping for maintenance..."
 
    SSLEngine On
    SSLProxyEngine On
    SSLCertificateFile /etc/letsencrypt/live/jenkins.DOMAIN/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/jenkins.DOMAIN/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
 
    ProxyRequests     Off
    ProxyPreserveHost On
    ProxyPass         / http://127.0.0.1:8888/ nocanon
    ProxyPassReverse  / http://127.0.0.1:8888/
    ProxyPassReverse  / http://jenkins.DOMAIN/
    AllowEncodedSlashes NoDecode
    ProxyPreserveHost on
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"
    <Proxy http://127.0.0.1:8888/*>
      Order allow,deny
      Allow from all
    </Proxy>
    #RewriteEngine On
    #RewriteCond %{HTTP_COOKIE} (JSESSIONID.[a-z0-9]+)
    #RewriteRule ^/?logout$ https://SSO.onelogin.com/trust/saml2/http-redirect/slo/519926 [R,CO=%1:LOGGED_OUT:;]
  </VirtualHost>
  # TLS Hardening
  #
  # Pseudo Random Number Generator (PRNG):
  # Configure one or more sources to seed the PRNG of the SSL library.
  # The seed data should be of good random quality.
  # WARNING! On some platforms /dev/random blocks if not enough entropy
  # is available. This means you then cannot use the /dev/random device
  # because it would lead to very long connection times (as long as
  # it requires to make more entropy available). But usually those
  # platforms additionally provide a /dev/urandom device which doesn't
  # block. So, if available, use this one instead. Read the mod_ssl User
  # Manual for more details.
  #
  SSLRandomSeed startup builtin
  SSLRandomSeed startup file:/dev/urandom 512
  SSLRandomSeed connect builtin
  SSLRandomSeed connect file:/dev/urandom 512

  ##
  ##  SSL Global Context
  ##
  ##  All SSL configuration in this context applies both to
  ##  the main server and all SSL-enabled virtual hosts.
  ##
  #
  #   Some MIME-types for downloading Certificates and CRLs
  #
  AddType application/x-x509-ca-cert .crt
  AddType application/x-pkcs7-crl    .crl

  #   Pass Phrase Dialog:
  #   Configure the pass phrase gathering process.
  #   The filtering dialog program (`builtin' is a internal
  #   terminal dialog) has to provide the pass phrase on stdout.
  SSLPassPhraseDialog  builtin

  #   Inter-Process Session Cache:
  #   Configure the SSL Session Cache: First the mechanism 
  #   to use and second the expiring timeout (in seconds).
  #SSLSessionCache         dbm:/var/run/apache2/ssl_scache
  SSLSessionCache        shmcb:/var/cache/mod_ssl/scache(512000)
  SSLSessionCacheTimeout  300

  #   SSL Cipher Suite:
  #   List the ciphers that the client is permitted to negotiate.
  #   See the mod_ssl documentation for a complete list.
  #   enable only secure ciphers:
  SSLCipherSuite  ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA
  SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

  SSLHonorCipherOrder On
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
  Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
  Header always set X-Frame-Options SAMEORIGIN
  Header set Cache-Control "no-cache, no-store, must-revalidate"
  Header set Pragma "no-cache"
  Header set Expires 0
</IfModule>